Automation testing and VAPT-style scans with evidence for teams in Singapore, WCAG AA audits for the Digital Service Standards, API and load testing. Transfer clauses for the PDPA; a tool, not a CSA-licensed service provider.
Checked on 2026-10-12: 1 of 3 read at the statute, regulator or government page; the rest from law-firm or practitioner summaries, marked as such. A law changes; this table carries the date so you can tell when it needs re-checking.
| Law or standard | What it requires of you | Status as checked | Source read |
|---|---|---|---|
| Personal Data Protection Act 2012, as amended in 2020 | Consent, purpose and reasonable-protection obligations, mandatory breach notification, and the transfer limitation obligation for personal data sent outside Singapore. | The 2020 amendments, including mandatory breach notification and higher penalties, took effect on 1 February 2021 according to law-firm summaries; the statute site refused automated access during this check. | www.roedl.comsecondary source |
| Digital Service Standards (government) | Government digital services meet usability and accessibility standards that embed WCAG Level A and AA, with enhancements announced in 2025. | Described by the Ministry of Digital Development and Information on 7 March 2025. No private-sector web accessibility statute was found for Singapore. | www.mddi.gov.sgprimary source |
| Cybersecurity Act 2018: licensing of penetration testing service providers | Providers of penetration testing services to Singapore customers must hold a licence from the Cyber Security Agency. | The licensing framework is in force and being revised, as reported by Singapore law firms; the statute was not read directly during this check. | www.rajahtannasia.comsecondary source |
Customer data is hosted in Mumbai, India. The transfer clauses in the Data Processing Addendum meet the PDPA’s transfer limitation obligation through the recipient’s controls; the addendum’s technical annex is the evidence of those controls.
The full table of instruments by regime is section 5 of the Data Processing Addendum; the current state of every certification we do and do not hold is on the trust centre.
WCAG Level AA, the level the Digital Service Standards embed for government services. The audit runs against WCAG 2.2 A, AA and AAA and reports at the level you select.
Audits map findings to sixty-six country standards and export a conformance report; how the accessibility module works.
The same job has a different name in every market, and sometimes the honest answer is that the name describes a service we are not.
Dokimore is a tool you run against systems you own, not a licensed penetration testing service provider. The scanner is the vulnerability assessment; the authorised exploitation step needs proven ownership and a signed record.
Security testingA real-browser recorder with locator heals a person approves; smart test selection runs only what a change touches.
Test recorderTransfer clauses and processor terms in the addendum; synthetic test data so staging holds no personal data.
Data Processing AddendumAudits against WCAG 2.2 with a conformance report at the level you select.
Accessibility auditsLoad profiles from a recorded flow; REST, GraphQL, gRPC and SOAP in the API studio.
API testing studioPrices are quoted in US dollars on every plan, before any tax your jurisdiction applies to imported software services. Self-serve plans are paid by card; Enterprise agreements are invoiced. If procurement needs a quotation with your tax identifiers, ask through the contact form (topic: billing).
Singapore is 2.5 hours ahead of Indian Standard Time, so the working days overlap almost entirely. Response targets by plan are on the service levels page.
Plans and caps are on the pricing page; response targets by plan are on the service levels page.
No, and it does not need to be: the licence applies to providers of penetration testing services, while Dokimore is software you run against systems whose ownership you have proven. If your policy requires a licensed provider’s report, that is a human service; the scanner’s evidence bundles are its input.
The transfer clauses in the Data Processing Addendum, which meet the PDPA’s transfer limitation obligation through the recipient’s controls. The addendum’s technical annex lists those controls.
They apply to government agencies’ digital services. Private organisations have no Singapore-specific web accessibility statute that this check could find, but many adopt WCAG AA by policy; the audit reports at the level you select.
Start on the Free plan, or bring one flow from your own product and we record it live.
We use one optional analytics tool, run on our own servers, to see which pages help people. It stays off unless you turn it on. Storage needed to sign you in, keep the site secure and remember this choice is always on. Cookie Policy